CVE-2014-7864

CVE-2014-7864 affects ZOHO ManageEngine OpManager (versions 8–11.5 build 11400) and IT360 (earlier 10.5). The issue is a blind SQL injection in the FailOverHelperServlet (FailServlet) via parameters in standbyUpdateInCentral, specifically customerName and serverRole, enabling remote attackers (un...

CVE-2015-1479

CVE-2015-1479 affects ZOHO ManageEngine ServiceDesk Plus (SDP) prior to version 9.0 build 9031. The vulnerability is an SQL injection in reports/CreateReportTable.jsp that allows remote authenticated users to execute arbitrary SQL commands via the site parameter. Root cause: improper input handli...

CVE-2015-1480

CVE-2015-1480 : ManageEngine ServiceDesk Plus (SDP) prior to 9.0 build 9031 is vulnerable to information disclosure. Remote authenticated users can obtain sensitive ticket data via (1) getTicketData action to servlet/AJaxServlet or (2) direct requests to swf/flashreport.swf, (3) reports/flash/det...

CVE-2014-9331

CVE-2014-9331 affects ManageEngine Desktop Central. A CSRF in roleMgmt.do allows an authenticated admin to add an administrator via addUser, enabling account creation without proper validation. Affected: Desktop Central before 9 build 90130 (and related 9.x builds). Impact is hijacking admin auth...

CVE-2014-9331: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an addUser action to STATEID/1417736606982/roleMgmt.do...

PT-2015-3935

Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine OpManager versions 8 through 11.5 build 11400 ZOHO ManageEngine IT360 version 10.5 and earlier Description The issue allows remote attackers and remote authenticated users to execute arbitrary SQL commands. This is achieved v...

CVE-2014-7864: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the FailOverHelperServlet aka FailServlet servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the 1 customerName or 2...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the 1 fromCustomer, 2 username, or 3 password parameter to HomePage.do...

CVE-2015-0866

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the 1 fromCustomer, 2 username, or 3 password parameter to HomePage.do...

CVE-2015-0866

CVE-2015-0866 affects Zoho ManageEngine SupportCenter Plus 7.9 (before hotfix 7941). The issue is two cross-site scripting (XSS) vulnerabilities where input from the fromCustomer, username, and password parameters to /HomePage.do is not properly sanitized. This can allow remote attackers to injec...

CVE-2015-0866

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the 1 fromCustomer, 2 username, or 3 password parameter to HomePage.do...

CVE-2015-0866: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the 1 fromCustomer, 2 username, or 3 password parameter to HomePage.do...

Two XSS Vulnerabilities in SupportCenter Plus

Advisory ID: HTB23247 Product: SupportCenter Plus Vendor: Zoho Corp. Vulnerable Versions: 7.9 and probably prior Tested Version: 7.9 Advisory Publication: January 7, 2015 without technical details Vendor Notification: January 7, 2015 Vendor Patch: January 23, 2015 Public Disclosure: January 28,...

SupportCenter Plus 7.9 Cross Site Scripting

Advisory ID: HTB23247 Product: SupportCenter Plus Vendor: Zoho Corp. Vulnerable Versions: 7.9 and probably prior Tested Version: 7.9 Advisory Publication: January 7, 2015 without technical details Vendor Notification: January 7, 2015 Vendor Patch: January 23, 2015 Public Disclosure: January 28,...

SupportCenter Plus 7.9 Cross Site Scripting Vulnerability

SupportCenter Plus version 7.9 suffers from a cross site scripting vulnerability. Product: SupportCenter Plus Vendor: Zoho Corp. Vulnerable Versions: 7.9 and probably prior Tested Version: 7.9 Advisory Publication: January 7, 2015 without technical details Vendor Notification: January 7, 2015...

Cross site scripting

Cross-site scripting XSS vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name parameter to GroupSubscription.do...

CVE-2014-3779

Cross-site scripting XSS vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name parameter to GroupSubscription.do...

CVE-2014-3779

Cross-site scripting XSS vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name parameter to GroupSubscription.do...

CVE-2014-3779

CVE-2014-3779 describes a cross-site scripting (XSS) vulnerability in Zoho ManageEngine ADSelfService Plus prior to 5.2 Build 5202. The issue arises in the web interface where the parameter named “name” passed to GroupSubscription.do is not properly sanitized, allowing remote attackers to inject ...

CVE-2014-3779: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name parameter to GroupSubscription.do...